reCAPTCHA for WooCommerce <= 1.4.7 - Unauthenticated CAPTCHA Bypass via WordPress Login and Lost Password Forms
- ID
- WPSEC-2026-2837
- Plugin
- reCAPTCHA for WooCommerce (recaptcha-woo)
- Affected
- from 1.2.9 before 1.5.0
- Remediation
- Update to 1.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- reCAPTCHA for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The reCAPTCHA for WooCommerce plugin for WordPress is vulnerable to a CAPTCHA bypass via the WordPress login and lost password forms in all versions up to, and including, 1.4.7. This is due to the plugin deciding whether the request is for wp-login.php with a loose substring match on the raw request URI, which an encoded path such as /wp-login.ph%70 does not match even though wp-login.php still runs. In addition, the login check is skipped whenever a valid WooCommerce login nonce is posted, and that nonce is shown to every visitor on the public My Account page. This makes it possible for unauthenticated attackers to send login attempts and password reset requests to wp-login.php without solving the reCAPTCHA. This defeats the brute-force and abuse protection the site owner turned on.
References
- https://wpsec.com/vuln/WPSEC-2026-2837/
- https://plugins.svn.wordpress.org/recaptcha-woo/tags/1.5.0/
- https://wordpress.org/plugins/recaptcha-woo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS